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CLAIMS 



1. A method of storing information relating to the transmission of 
messages by an entity over a given time period/comprising the step of 
creating a signature comprising a plurality pi parameters related to the 
transmission of messages over that time period wherein the parameters 
comprise at least one parameter related \p the transmission of messages 
over a portion of the period and also related to the position of the portion in 
the period, to enable output data to be derived from the stored information. 

2. A method as claimed in claim A wherein the signature is created in 
one of a plurality of predetermined possible formats. 

3. A method as claimed in claim 2 wherein the format of the signature 
comprises the length of the signature. 

4. A method as claimed In claim 1 wherein said at least one parameter 
represents the number of events made in the portion of the time period as a 
proportion of the total number of events made in the whole time period. 

5. A method as claimed in claim 1 wherein said at least one parameter 
represents the numbe/of events of a predetermined type made in the whole 
time period as a proportion of the total number of events of the same type 
made in the whole time period. 

6. A method as claimed in claim 1 wherein the step of creating a 
signature further/comprises the steps of: 

storing information about each of a number of events which occurred during 
the time per^; 





7. A method as claimed in clainVT^ising an anomaly detector, wherein 
the stored information is provided /s(jp(pWto the said anomaly detector in 
order to detect anomalies in the ^transmission of messages by the entity. 

8. A method as claimed in^efaim 7 wherein the anomaly detector 
comprises a neural netwpfK. 



9. The method of claim 1 further comprising the steps of: 
creating a second signature comprising a plurality of parameters related to 
the transmission of messages over a second period shorter than the first 
and more recent than the first; ^/T 

updating the first signatureyl^a^eighted averaging with the second 

signature; and / 

deriving said output da^r using the signatures. 

10. The method of claim 1 wbferein the data deriving step is carried out 
using a predictive model, the ixfethod further comprising the steps of: 
monitoring the perform ance>of the model ; and 

automatically updating me model when the performance reaches a 
predetermined threshold/ 

1 1 . The method of claim 1 wherein the data deriving step is carried out 
using a predictive model, and wherein the model is implemented using at 
least one instantiated object created using an object oriented programming 
language and the method further comprises the steps of: 

converting the/object into a data structure; 




storing the dkta structure; and 

recreating thfe object from the data structure. 

12. A computer system for storing information relating to the transmission 
of messages tw an entity over a given time period comprising: 

an input arranged to receive information about each of a number of events 
which occurrediduring the time period; 

a processor arranged to convert the information into a signature comprising 
a plurality of parameters related to the transmission of messages over the 
time period whdrein the parameters comprise at least one parameter 
related to the transmission of messages over a portion of the period and 
also related to the! position of the portion in the period, to enable output data 
to be derived fromlthe stored information. 

13. A method of deriving output data from information relating to the 
transmission of messages by an entity over time, comprising the steps of: 

(I) creating a first signature comprising a plurality of parameters related to 
the transmission of messages over a predetermined first time period; 

(ii) creating a second signature comprising a plurality of parameters related 
to the transmission of messages over a second period shorter than the first 
and more recent than the first; 

(iii) updating the first signature by a weighted averaging with the second 
signature; \ 

and (iv) deriving said output data using the signatures. 

14. A method a(s/claimed in claim 13 wherein the lengths of the first 
period and the seeifhd period are fixed for a particular instantiation of the 
method. / / 
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15. A method as claimed in cljiim 13 wherein said step (iii) of updating 
the first signature by a weighteq averaging with the second signature further 
comprises the steps of: 
(I) determining a third signaturfe comprising a plurality of parameters related 
to the transmission of messages over a third period shorter than the second 
and more recent than the second; 

and (ii) updating th^econ/l signature by a weighted averaging with the 
third signature- 
such that in use an upW-date comparison of the second signature with the 
first signature can be^ofttained. 
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16. A method aM^aimed in claim 15 wherein the length of the third 
period is variable. 

17. A method ds claimed in claim 13 wherein said step (iii) of updating 
the first signature by a weighted averaging with the second signature further 
comprises the step of calculating an exponentially weighted moving 
average of the first and second signatures. 

18. A method as claimed in/claim 13 wherein the deriving step 
comprises the step of detecting anomalies in the transmission of messages 
in a telecommunications/network. 



19. A mstfibd ds claimed in claim 13 wherein the step of comparing the 
second signage with the updated first signature comprises the use of a 
neural netwcjfk. 



N>20. The method of claim 13 wherein the data dj3nvjng_^Uj|j \is oaiiiuJ uur 
using a predictiyejnodetrtffeTHeThod further comprising the steps of: 
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monitoring the performance of the model ; and ^^^^^ 
automatically updating the_jri£deJ — whHrr^TFTeperformance reaches a 
predetgjjiwtedlHre 



21. The method of claim 13 wherein thedata deriving step is carried out 
using a predictive model, and wherein the model is implemented using at 
least one instantiated object created using an object oriented programming 
language and the method further comprises the steps of: 

converting the object into a data structure; 
storing the data structure; and / 
recreating the object from the data structure. 

22. A computer system for deriving output data from information relating 
to the transmission of messages by an entity over time, the system 
comprising: / 

an input arranged to receive information about the transmission of 
messages by the entity; / 

a processor arranged to create a first signature comprising a plurality of 
parameters related to the transmission of messages over a predetermined 
first time period and to create a second signature comprising a plurality of 
parameters related to trie transmission of messages over a second period 
shorter than the first amd more recent than the first; 

a processor arranged to calculate a weighted averaging of the first and 

second signatures to form an updated first signature; 

and a processor ar/anged to derive said output data using said signatures. 




